Figure 1: Concept of the PrivacyHat : Muting a smart speaker byplacing an object on top of it.

Making Privacy Graspable: Can weNudge Users to use Privacy EnhancingTechniques?

Christian TiefenauUniversity of BonnBonn, Germanytiefenau@cs.uni-bonn.de

Maximilian HäringFraunhofer FKIEBonn, Germanyhaering@cs.uni-bonn.de

Eva GerlitzFraunhofer FKIEBonn, Germanygerlitz@cs.uni-bonn.de

Emanuel von ZezschwitzUniversity of Bonn, FraunhoferFKIEBonn, Germanyzezschwitz@cs.uni-bonn.de

Copyright is held by the author/owner. Permission to make digital or hard copies of allor part of this work for personal or classroom use is granted without fee. Posterpresented at the 15th Symposium on Usable Privacy and Security (SOUPS 2019).

AbstractSmart speakers are gaining popularity. However, such de-vices can put the user’s privacy at risk whenever hot-wordsare misinterpreted and voice data is recorded without theuser’s consent. To mitigate such risks, smart speakers pro-vide privacy control mechanisms like the build-in mute but-ton. Unfortunately, previous work indicated that such mutebuttons are rarely used. In this paper, we present the Pri-vacy Hat, a tangible device which can be placed on thesmart speaker to prevent the device from listening. Wedesigned the Privacy Hat based on the results of a focusgroup and developed a working prototype. We hypothesizethat the specific user experience of this physical and tangi-ble token makes the use of privacy-enhancing technologymore graspable for the user. As a consequence, we ex-pect that the Privacy Hat nudges users to more actively useprivacy-enhancing features like the mute button. In addition,we propose the Privacy Hat as a study tool as we hypothe-size that the artifact supports participants in reflecting theirbehaviour. We report on the concept, the prototype and ourpreliminary results.

Author KeywordsSmart speaker; tangible privacy; privacy hat; iot study plat-form

arX

iv:1

911.

0770

1v1

[cs

.HC

] 1

8 N

ov 2

019

ACM Classification KeywordsH.5.m [Information interfaces and presentation (e.g., HCI)]:Miscellaneous

IntroductionThe number of smart speakers like the Amazon Echo [1],the Google Home [5] or Apple’s HomePod [3] grew 2018 by39.8% in the US, resulting in an estimated usage by 66.4million American households [8]. Since their introductionin 2014, usable security research aimed at understand-ing usage behavior and risk perception of smart speakerusers. Several studies found that users generally expresslittle privacy concerns, especially due to an incomplete un-derstanding of the security risks or resignation [4, 2, 7]. Pri-vacy controls like the mute button or audio logs seem to berarely used. One reason for these circumstances can bethat these mechanisms do not align with the users’ privacycontrol needs. Related work suggests to nudge users withprivacy notices to reflect on decisions, so that they can takeinformed privacy-related actions [7]. Following this line ofthoughts, we hypothesize that providing users with a phys-ical and tangible device can help them to a better under-standing of the privacy-topic and furthermore nudge themto reflect on their daily smart speaker interaction.

Figure 2: Our prototype in theearly stage. Here, we tried using aRFID-tag scanner in combinationwith an Arduino.

Closely related to our project is the artistic DIY-concept“Project Alias” [6]. Users can 3D-print a physical tokenthat is then placed on top of a smart speaker. The use ofwhite noise disables the speakers’ ability to listen to theactivation word. The device itself serves as a trusted com-ponent which can be activated by an individual hot word. Ifthe hot word is received, “Project Alias” stops sending whitenoise and activates the smart speaker for further interac-tion. While we acknowledge “Project Alias” as a potentialsolution, it does not foster physical interaction with the de-vice itself nor does it communicate the device’s status.

In contrast, our Privacy Hat is a tangible object that can beplaced on top of a smart speaker to prevent it from listen-ing and was designed to provide implicit visual feedbackon the smart speaker’s state. Since anyone in the roomcan observe if the Privacy Hat is placed on the device ornot, we expect that the concept can provide unintrusivebut clear privacy notices that may trigger usage-reflection.To inform the design of Privacy Hat, we performed a focusgroup with four smart speaker users. We asked them abouttheir current smart speaker usage behavior and discussedalternative interaction paradigms that could support privacy-awareness and trigger the active use of the privacy control“muting.”

In addition to the development of the Privacy Hat, we presenta smart home study-framework that enables us to get feed-back of the participants’ actual device usage in the field.This framework will be used to measure the effect of thePrivacy Hat in our participants’ actual smart homes.

We like to note that our concept is not simply a usability-optimized solution to the privacy-related problems of smart-home users. For this we would have proposed a conceptwhich supports remote control of such a functionality. Onthe contrary, our concept suggests that users have to ac-tively put an object on top of the device and thus have tophysically go to the speaker to perform the action. We hy-pothesize that requiring explicit physical interaction makesthe process more tangible, has potential to affect the users’privacy-related behavior and helps them to reflect abouttheir behavior. We anticipate that this tool will give us addi-tional insights into the smart home user’s reasoning whenusing privacy-enhancing technology.

Research questionsWith the concept and preliminary study presented in thispaper, we aim to explore the following research questions:

• How do users interact with the traditional mute buttonand what do they think about it?

• Is a tangible “Mute-Token” perceived beneficial byusers?

• Can a tangible “Mute-Token” help gather additionalinsights on user behavior and thoughts?

Privacy HatBy providing a new mechanism, so that the act of mutingthe smart device is transformed into a explicit, physical ac-tion, we aim to nudge the user to reflect on their interactionwith the device, especially their muting behaviour. In ourstudy this mechanism takes the form of the Privacy Hat :Covering the device with the Privacy Hat (see Figure 1) willmute it and give a new visual representation on the statusof the speaker, different to the usual flashing red LEDs.

Figure 3: A sketch, how ourstudy-framework looks like. TheRaspberry Pi is placed below theEcho Dot and connected internallyto its mute button and LED. Thedistance sensor is placed on theside of the platform to detectobjects on top of the device.

To test this concept and before we developed the proto-type, we were interested in users’ opinions towards the ideaof using this way to mute a smart speaker and if it wouldchange their perception towards the device. For this, weconducted a focus group with four participants who had al-ready used an Amazon Echo in their households for severaltasks, including setting a timer, listening to music or newsand controlling smart home devices like smart bulbs or out-lets. They positively stressed its sound and “human”-likevoice while disliking when they had to talk about the de-vice itself whenever other people are visiting them in theirhomes. All of them stated that privacy is important to them.

One participant regularly used the mute button before go-ing to bed and one mentioned using it when talking aboutsensitive data.

After introducing them to the principle of the Privacy Hat,we asked them how they would use such a token and howit would change their perception. They mentioned, that thepositioning of the smart speaker is crucial to this concept,so that anyone who is entering the room can see it. In addi-tion to just placing something on top of the device, they pre-sented the idea of “remote” muting stations that are placedat several places in the room. Also they could imagine us-ing the token as some kind of authentication token, placingit the other way around on top of the speaker for specific ac-tions that require user authentication, for example placingan order. Related to the design they agreed on using somekind of hat that covers the device completely to connote amore secure feeling.

Proposed study designFor an evaluation of the concept, a platform that enables usto track the muting-behavior of a smart speaker is needed.In the following we will discuss a prototype and give furtherdetails on the upcoming study.

PrototypeWe assembled a prototype that uses a Raspberry Pi asthe main component. For the smart speaker we chose amodified Amazon Echo Dot as seen in Figure 2. For themodification, we soldered a wire to the red status LED ofthe muting button to capture the current muting status of theEcho Dot. Another wire was placed on the contact of thephysical mute-button enabling the Raspberry Pi to triggerit. To sense if something is put on the Echo Dot we tried tointegrate a distance sensor into the Echo Dot itself. How-ever, this did not turn out as an applicable scenario due to

size restrictions. Therefore, we placed the sensor in a 3D-printed case, that acts as a docking station for the Dot (seeFigure 4). A python script on the Raspberry Pi tracks themuting events of the participants as well as whether theevent was triggered by pressing the button or by putting thePrivacy Hat on the device. The way of muting, the status ofthe device and the time are then logged.

Directions for Future WorkWe are in preparation of a pilot study, that will provide theparticipants with a default object to mute the Echo Dot, asproposed by the participants of our focus group. However,technically every object could be used to provide this func-tionality. If this approach turns out to be promising, furtherstudies can evaluate the "best" and most useful design forsuch a token. To test if the proposed prototype can help toanswer our research questions, we plan to conduct a fieldstudy that tests both aspects. Over the course of severalweeks, we will gather data and observe muting behaviorafter introducing the Privacy Hat. For this, we will hand outmodified Amazon Echo Dots to participants that have notused a smart home speaker before. This way, we try to en-sure that the novelty effect of the device will be nearly thesame for everyone. We want to point out that the noveltyeffect may benefit our study design. However, we do notwant to measure the behavior of users in the most realisticscenario but trigger reflection and experimenting.

Figure 4: Top view of our prototypewith the sensor placed on the side.

The current plan of the study spans 4 weeks and is splitinto two phases that will each last two weeks to counter thepossible novelty effect of introducing a smart home speakerand a resulting higher frequency in usage. In phase onewe will only be observing the actual usage of the Echo Dotwith focus on the muting-behavior. For the second phase,which will also last two weeks, we will present the PrivacyHat to the participants as an alternative way to mute the

device. We will still be collecting the muting behavior of ourparticipants to then evaluate the actual effect of a tangiblemuting option.

After the two phases we will conduct interviews concerningthe participants general opinion about the concept of thePrivacy Hat, which aspects they like and whether they seepotential for improvement. Additionally, we are interestedin the participants’ perceptions regarding privacy, whetherthese perceptions change when having a tangible mutingoption and if they consciously note a shift in their own mut-ing behaviour. For this, we will ask for the muting frequencyand which events caused them to use the Privacy Hat.

We proposed and discussed the Privacy Hat, an examplefor a graspable privacy enhancing technology in smarthomes. We argue that this principle can be used to eval-uate privacy perceptions in other scenarios as well. We areconfident that making the usage of IoT devices more tangi-ble is a promising area worth looking at, since it could helpthe users to reduce resignation and make them feel morein control. In addition, the proposed study framework canbe used to track actual user behavior in the field and nowenables us to compare the already self-reported data withempirical measured ones.

REFERENCES1. Amazon. 2019. Amazon Echo (2nd Generation).

(2019). https://www.amazon.com/dp/B075RSCZHD(accessed 06/01/19).

2. Tawfiq Ammari, Jofish Kaye, Janice Y. Tsai, and FrankBentley. 2019. Music, Search, and IoT: How People(Really) Use Voice Assistants. ACM Trans.Comput.-Hum. Interact. 26, 3, Article 17 (April 2019),28 pages. DOI:http://dx.doi.org/10.1145/3311956

3. Apple. 2019. Apple HomePod. (2019).

https://www.apple.com/homepod/ (accessed06/01/19).

4. Joseph Bugeja, Andreas Jacobsson, and PaulDavidsson. 2016. On privacy and security challenges insmart connected homes. In 2016 European Intelligenceand Security Informatics Conference (EISIC). IEEE,172–175.

5. Google. 2019. Google Home. (2019).https://store.google.com/product/google_home(accessed 06/01/19).

6. Bjoern Karmann. 2019. Project Alias. (2019).https://github.com/bjoernkarmann/project_alias

(accessed 06/01/19).

7. Josephine Lau, Benjamin Zimmerman, and FlorianSchaub. 2018. Alexa, are you listening?: Privacyperceptions, concerns and privacy-seeking behaviorswith smart speakers. Proceedings of the ACM onHuman-Computer Interaction 2, CSCW (2018), 102.

8. voicebot.ai. 2019. Smart Speaker Consumer ReportMarch 2019. (2019).https://voicebot.ai/wp-content/uploads/2019/03/smart_speaker_consumer_adoption_report_2019.pdf(accessed 06/01/19).